JP2012104054A - Identification device, identification method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To secure the storage capacity of an auxiliary storage device and reduce a load on a CPU when identifying a communication apparatus.SOLUTION: A program management unit 11 receives an addition instruction or a deletion instruction of a program for analyzing a packet of a predetermined protocol to extract predetermined property information, and adds the program to a program storage unit 1 or deletes the program from the program storage unit 1. A response analysis unit 4 and a capture analysis unit 6 execute a program stored in the program storage unit, thereby analyzing a packet received by a response reception unit 3 and a packet capturing unit 5 to extract property information of a communication device. An identification unit 15 calculates a distance between property information stored in a dictionary storage unit 14 and the property information extracted by the response analysis unit 4 and the capture analysis unit 6. Then, the identification unit identifies one piece of model number information from among model number information associated with property information with a short distance as model number information of a communication device connected to a network.

Description

  The present invention relates to an identification device, an identification method, and a program for identifying a communication device connected to a network.

In recent years, many electric appliances having a communication function have been produced.
Patent Document 1 discloses a method for determining the type of electrical appliance connected to a network. Specifically, response packets and request packets are received for electrical appliances connected to the network, scored by comparing with dictionary information defined for each electrical appliance in advance, and associated with the dictionary information with the highest score. It is determined that the determined type is the type of the electrical appliance to be determined.

JP 2010-97587 A

However, when identifying a communication device using the method described in Patent Document 1, the characteristics of the electrical appliance are extracted by analyzing a packet of a predetermined protocol. There is a problem that characteristic information that is not formed is extracted.
In addition, if the identification device is used for a long period of time, there is a possibility that a communication device that performs communication using a protocol that did not exist at the start of use of the identification device may be connected to the network. When the communication device is identified by using it, there is a possibility that new protocol analysis cannot be executed and characteristic information cannot be extracted.

  An identification device for identifying a communication device connected to a network is mainly mounted on a home gateway device or the like in which the storage capacity and CPU power of the auxiliary storage device are smaller than those of other devices such as a PC. Therefore, it is desired to secure the storage capacity of the auxiliary storage device and reduce the load on the CPU by reducing the amount of programs for executing the functions of the dictionary creation device as much as possible.

  The present invention has been made to solve the above-described problem, and is an identification device for identifying a communication device connected to a network, wherein the reception unit receives a packet from the communication device, and the reception unit receives the packet. A program storage unit for storing one or more programs for extracting predetermined characteristic information by analyzing a packet of the predetermined protocol, and receiving an instruction for adding or deleting the program, and adding a program to the program storage unit or A program management unit for deleting a program from the program storage unit, and characteristic information indicating characteristics of the communication device by analyzing a packet received by the reception unit by executing a program stored in the program storage unit A dictionary description that stores the analysis unit to be extracted, the characteristic information of the communication device, and the model number information of the communication device in association with each other. One type number among the comparison unit that calculates the similarity between the characteristic information stored in the unit and the characteristic information extracted by the analysis unit, and the model number information associated with the characteristic information with the high degree of similarity calculated by the comparison unit And an identification unit that identifies that the information is model number information of a communication device connected to the network.

  In the present invention, the recording unit may include, as characteristic information indicating that there is no information, characteristic information that is not extracted by the analysis unit among characteristic information that can be extracted by the program stored in the program storage unit. It is preferable to record in the dictionary storage unit.

  In the present invention, the comparison unit is similar to the characteristic information that can be extracted by the program stored in the program storage unit among the characteristic information stored in association with the same model number information in the dictionary storage unit. It is preferable to calculate the degree.

  In the present invention, the dictionary storage unit stores the model number table for storing the model number information of the communication device in association with the identification information unique to the communication device, and the identification information and the device information in association with each other. The detailed table is stored, and the recording unit records the characteristic information collected by the collecting unit in the model number table in association with the identification information of the communication device, and the model number information input by the input unit is stored in the communication unit. It is preferable to record in the detailed table in association with the identification information of the device.

  Further, in the present invention, a display unit that displays a predetermined number of model number information associated with the highest similarity among the similarities calculated by the comparison unit, and selection of the model number information displayed by the display unit is selected. It is preferable that the identifying unit identifies that the model number information selected by the selecting unit is model number information of a communication device connected to a network.

  The present invention is also an identification method using an identification device for identifying a communication device connected to a network, wherein the reception unit receives a packet from the communication device, and the program management unit is received by the reception unit. Analyzing the packet of the predetermined protocol and receiving the instruction for adding or deleting the program for extracting the predetermined characteristic information, adding the program to the program storage unit or deleting the program from the program storage unit for analysis The unit analyzes the packet received by the receiving unit by executing a program stored in the program storage unit, and extracts characteristic information indicating the characteristic of the communication device. Similarity between the characteristic information stored in the dictionary storage unit that stores the model number information of the communication device in association with the characteristic information extracted by the analysis unit The identification unit calculates and identifies that one piece of model number information from among the model number information associated with the characteristic information having a high similarity calculated by the comparison unit is the model number information of the communication device connected to the network. It is characterized by.

  In addition, the present invention includes a program storage unit that stores one or more programs that analyze packets of a predetermined protocol and extract predetermined characteristic information, and an identification device that identifies a communication device connected to a network, A receiving unit that receives a packet from a communication device, a program management unit that accepts an instruction to add or delete a program and adds a program to the program storage unit or deletes a program from the program storage unit, the program storage unit The analysis unit extracts the characteristic information indicating the characteristics of the communication device by analyzing the packet received by the reception unit by executing a program stored in the communication device, and associates the characteristic information of the communication device with the model number information of the communication device Calculating the similarity between the characteristic information stored in the dictionary storage unit and the characteristic information extracted by the analysis unit. Function as an identification unit for identifying that one piece of model number information is model number information of a communication device connected to a network from among model number information associated with characteristic information having a high degree of similarity calculated by the comparison unit It is a program to make it.

  According to the present invention, the program management unit can add / delete a program for analyzing a packet of a predetermined protocol to the program storage unit. Thereby, the amount of the program stored in the auxiliary storage device can be made appropriate, and the identification process can be executed using an appropriate protocol.

It is a schematic block diagram which shows the structure of the dictionary creation apparatus which produces the dictionary information which an identification apparatus uses. It is a figure which shows the structure of the table which each memory | storage part memorize | stores. It is a flowchart which shows the operation | movement which extracts characteristic information. It is a flowchart which shows the operation | movement which associates characteristic information and model number information. It is a figure which shows the example of a display of the list screen of the set of characteristic information. It is a figure which shows the example of a display of the input screen of model number information. It is a flowchart of the generation process of a characteristic name list. It is a schematic block diagram which shows the structure of the identification apparatus by one Embodiment of this invention. It is a flowchart which shows the operation | movement which an identification apparatus identifies a communication apparatus. It is a figure which shows the example of a display of an identification result screen.

《Dictionary creation stage》
Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a schematic block diagram showing the configuration of a dictionary creation device that creates dictionary information used by the identification device according to the present invention.
The dictionary creation device creates dictionary information for specifying a communication device connected to a network. In the present embodiment, the communication device includes not only communication devices such as routers and network HUBs but also electric appliances (PCs, televisions, game devices, etc.) having a communication function.
The dictionary creation device includes a program storage unit 1, a request transmission unit 2, a response reception unit 3, a response analysis unit 4 (analysis unit), a packet capture unit 5, a capture analysis unit 6 (analysis unit), a characteristic storage unit 7, and a display unit. 8, a selection unit 9, an input unit 10, a program management unit 11, a program information storage unit 12, a recording unit 13, and a dictionary storage unit 14.

The program storage unit 1 stores a program used by the request transmission unit 2, the response analysis unit 4, and the capture analysis unit 6 for packet transmission and packet analysis. Specifically, an active measurement program that transmits a request packet to the communication device, analyzes a response packet for the request packet, and a passive analysis program that analyzes a request packet received from the communication device is stored. One program can execute processing for one protocol, and the program storage unit 1 stores a different program for each protocol.
The request transmission unit 2 reads a program for transmitting a packet of a predetermined protocol from the program storage unit 1, and transmits the packet of the predetermined protocol to a communication device connected to the network by executing the program indicated by the program. be able to.

The response receiving unit 3 receives a response packet for the request packet transmitted by the request transmitting unit 2 from the communication device.
The response analysis unit 4 reads a program corresponding to the response packet received by the response reception unit 3 from the program storage unit 1, and analyzes the response packet by executing the program indicated by the program. In addition, the response analysis unit 4 extracts characteristic information indicating the characteristics of the communication device by analyzing the response packet. Here, the characteristic information indicates information included in a packet transmitted by the communication device, and includes, for example, an open / closed state of the communication port, IPv4 option information, and the like. In addition, the response analysis unit 4 records the extracted characteristic information in the characteristic storage unit 7 in association with the MAC address of the communication device.

The packet capture unit 5 captures a packet transmitted by the communication device. Note that in this embodiment, packet capture is received when a packet transmitted from a communication device to another device is relayed, received by a global address / multicast address received in communication within the same segment, port mirroring, or the like. This refers to reading a packet addressed to another device.
The capture analysis unit 6 reads a program corresponding to the packet captured by the packet capture unit 5 from the program storage unit 1, and analyzes the packet by executing the program indicated by the program. Further, the capture analysis unit 6 extracts characteristic information indicating the characteristics of the communication device by analyzing the packet. The capture analysis unit 6 records the extracted characteristic information in the characteristic storage unit 7 in association with the MAC address of the communication device.

FIG. 2 is a diagram illustrating a configuration of a table stored in each storage unit.
FIG. 2A shows the configuration of the characteristic accumulation table stored in the characteristic storage unit 7.
The characteristic accumulation table is a table that stores characteristic information extracted by the response analysis unit 4 and the capture analysis unit 6, and associates the MAC address of the communication device, the property name, the IP address of the communication device, the characteristic value, and the recording date and time. Store.
The characteristic name stored in the characteristic accumulation table is a parameter name of characteristic information extracted by the response analysis unit 4 and the capture analysis unit 6.
The characteristic value stored in the characteristic accumulation table is the value of the characteristic information extracted by the response analysis unit 4 and the capture analysis unit 6.
The characteristic accumulation table uses a combination of a MAC address and a characteristic name as a main key.

The display unit 8 displays information on the display. Specifically, for each communication device indicated by the characteristic information stored in the characteristic storage unit 7, processing for displaying a set of characteristic information on the display, or input of model number information of the communication device indicated by the characteristic information selected by the selection unit 9 Execute processing to display the screen on the display.
The selection unit 9 accepts selection of a set of characteristic information displayed by the display unit 8 from the user.
The input unit 10 receives input of model number information on the input screen displayed by the display unit 8.

  The program management unit 11 receives an instruction to add a new program or an instruction to delete a predetermined program, and adds a program to the program storage unit 1 or deletes a program from the program storage unit 1. The program management unit 11 records information indicating the state of the program stored in the program storage unit 1 in the program information storage unit 12.

FIG. 2B is a diagram illustrating a configuration of a program registration table stored in the program information storage unit 12.
The program registration table is a table that stores the state of the program stored in the program storage unit 1. The program ID for identifying the program stored in the program storage unit 1, the start time indicating the time when the use of the program is started, Stores an end time indicating a time when the use of the program is ended. The program registration table uses a combination of a program ID and a start time as a main key.
FIG. 2C is a diagram illustrating a configuration of a parameter table stored in the program information storage unit 12.
The parameter table is a table that stores special information that can be extracted using a program, and stores a program ID, a start time, and a characteristic name. The parameter table uses a combination of a program ID and a start time as a main key.
The recording unit 13 refers to the information stored in the program information storage unit 12 and associates the characteristic information selected by the selection unit 9 among the characteristic information stored in the characteristic storage unit 7 with the model number information input by the input unit 10. And is recorded in the dictionary storage unit 14 as dictionary information.

FIG. 2D shows the configuration of the model number table stored in the dictionary storage unit 14.
The model number table is a table that stores model number information of a communication device, and includes a dictionary creation device ID that is identification information of the dictionary creation device, a learning ID generated for each extraction process of characteristic information, and a model number that indicates the model number of the communication device. The learning date and time indicating the time when the information and the characteristic information extraction processing are executed are stored in association with each other. In the model number table, a combination of a dictionary creation device ID and a learning ID is used as a main key. The model number information is information including a category of a communication device, a manufacturer name, a device name, a model number, and a comment.

FIG. 2E shows a configuration of a detailed table stored in the dictionary storage unit 14.
The detailed table is a table that stores characteristic information of the communication device, and stores a dictionary creation device ID, a learning ID, a characteristic name, and a characteristic value in association with each other. The characteristic name and characteristic value are the characteristic name and characteristic value stored in the characteristic accumulation table stored in the characteristic storage unit 7. The detailed table uses a combination of a dictionary creation device ID, a learning ID, and a characteristic name as a main key.

FIG. 2F shows the configuration of the learning parameter table stored in the dictionary storage unit 14.
The learning parameter table is a table that stores characteristic names of characteristic information extracted by the program used for analysis by the response analysis unit 4 and the capture analysis unit 6, and stores the dictionary creation device ID, the learning ID, and the characteristic name in association with each other. To do. The detailed table uses a combination of the dictionary creation device ID and the learning ID as a main key.

Next, the operation of the dictionary creation device according to the present embodiment will be described.
First, processing for adding / deleting a program to / from the dictionary creating apparatus will be described.
When a user or a system administrator inputs a program addition instruction and data of a program to be added to the dictionary creation device, the program management unit 11 receives the program addition instruction and the input of the program data, and stores the program data in the program Record in Part 1. As a result, the request transmission unit 2, the response analysis unit 4, and the capture analysis unit 6 can execute the functions of the new program.

Further, the program management unit 11 records the program ID and the current time of the added program in the program information storage unit 12. Specifically, the program ID of the added program is recorded in the program ID of the program registration table stored in the program information storage unit 12, and the current time is recorded as the start time. When adding a program, the end time of the program registration table is set to NULL. Further, the program ID of the added program is recorded in the program ID of the parameter table stored in the program information storage unit 12, and the current time is recorded as the start time. Then, the characteristic name of the characteristic information extracted by the added program is recorded in the characteristic name of the program information storage unit 12.
The above is the operation of the dictionary creation device when adding a program.

On the other hand, when the user or the system administrator inputs the program deletion instruction and the program ID of the program to be deleted to the dictionary creation device, the program management unit 11 receives the program deletion instruction and the input of the program ID, and receives the corresponding program ID. The data of the program it has is deleted from the program storage unit 1. Thereby, the request transmission unit 2, the response analysis unit 4, and the capture analysis unit 6 do not execute the functions of the program. Further, the program management unit 11 records the current time at the end time associated with the same program ID as the program ID of the deleted program in the program registration table stored in the program information storage unit 12.
The above is the operation of the dictionary creation device when deleting a program.

The advantages of adding / deleting programs will be described below.
The dictionary creation device is mainly mounted on a home gateway device or the like. The storage capacity of the auxiliary storage device mounted on the home gateway device is often small compared to other devices such as a PC. For this reason, it is desirable to reduce the amount of programs that execute the function of the dictionary creation device stored in the auxiliary storage device as much as possible.
Therefore, in the present embodiment, the programs executed by the request transmission unit 2, the response reception unit 3, and the packet capture unit 5 are stored in the auxiliary storage device by causing the program storage unit 1 to store only the programs corresponding to the necessary protocols. The amount of programs to be executed can be made appropriate. Thereby, the storage capacity of the auxiliary storage device can be secured and the load on the CPU can be reduced.

  In addition, when the dictionary creation device is used for a long time, a communication device that performs communication using a protocol that did not exist when the dictionary creation device was used may be connected to the network. Even in such a case, by storing a new program corresponding to the protocol in the program storage unit 1, the dictionary creation device can create dictionary information using an appropriate protocol.

Next, the operation of analyzing the packet of the communication device and extracting characteristic information will be described.
FIG. 3 is a flowchart showing an operation of extracting characteristic information. The operation for extracting the characteristic information differs depending on whether the dictionary creation device executes the active measurement program stored in the program storage unit 1 or the passive analysis program. The dictionary creation device may execute only one of the active measurement program and the passive analysis program, or may execute both simultaneously.
Here, first, the operation when the dictionary creation device executes the active measurement program stored in the program storage unit 1 will be described.

  The request transmission unit 2 creates a request packet of a predetermined protocol by executing the active measurement program stored in the program storage unit 1, and transmits the packet to the communication device (step S1). When the communication device receives the request packet from the dictionary creation device, the communication device creates a response packet having the same protocol as the packet, and transmits the packet to the dictionary creation device.

  When the response reception unit 3 of the dictionary creation device receives a response packet from the communication device (step S2), the response analysis unit 4 executes the active measurement program stored in the program storage unit 1, and receives the received response packet as a predetermined packet. Analysis is performed based on the protocol (step S3). That is, the response analysis unit 4 reads a plurality of characteristic name and characteristic value pairs from the header information of the response packet. Next, the response analysis unit 4 extracts characteristic information from the analyzed response packet (step S4). That is, a set indicating the characteristics of the communication device is extracted from the set of read characteristic names and characteristic values.

  Then, the response analysis unit 4 records the extracted characteristic information in the characteristic accumulation table stored in the characteristic storage unit 7 (step S5). Specifically, the MAC address of the communication device that is the transmission source of the packet received by the response receiver 3 is stored in the MAC address of the characteristic accumulation table. The characteristic name of the characteristic information analyzed by the response analysis unit 4 is stored in the characteristic name. The IP address of the communication device that is the transmission source of the packet received by the response receiver 3 is stored in the IP address. The characteristic value of the characteristic information analyzed by the response analysis unit 4 is stored in the characteristic value. The current time is stored in the recording date.

  Next, the request transmission unit 2 determines whether or not a predetermined time (for example, 1 hour) has elapsed since the transmission of the request packet in step S1 (step S6). If it is determined that the predetermined time has elapsed (step S6: YES), the process returns to step S1, and the request packet is transmitted again to the communication device. Thereby, the request transmission part 2 can transmit a request packet regularly.

  On the other hand, when the request transmission unit 2 determines that the predetermined time has not elapsed (step S6: NO), the dictionary creation device has input a processing end request from the outside by an operation or interruption processing by a user or the like. Whether or not (step S7). When it is determined that the termination request has not been input from the outside (step S7: NO), the dictionary creation device returns to step S6 and determines whether or not a predetermined time has elapsed. On the other hand, when it is determined that the termination request has been input from the outside (step S7: YES), the dictionary creation device ends the process.

Next, an operation when the dictionary creation device executes a passive analysis program stored in the program storage unit 1 will be described.
The packet capture unit 5 captures the packet transmitted by the communication device (step S8). Next, the capture analysis unit 6 executes the passive analysis program stored in the program storage unit 1, and analyzes the captured packet based on a predetermined protocol (step S9). Next, the capture analysis unit 6 extracts characteristic information from the analyzed packet (step S10). Then, the capture analysis unit 6 records the extracted characteristic information in the characteristic accumulation table stored in the characteristic storage unit 7 (step S11).

Next, the dictionary creation device determines whether or not a processing end request has been input from the outside by an operation by the user or an interruption process (step S12). If it is determined that the termination request is not input from the outside (step S12: NO), the dictionary creation device returns to step S8. On the other hand, when it is determined that the termination request has been input from the outside (step S12: YES), the dictionary creation device ends the process.
Through the above processing, the characteristic information of the communication device is accumulated in the characteristic storage unit 7.

Next, an operation for associating the characteristic information stored in the characteristic storage unit 7 with the model number information of the communication apparatus will be described.
FIG. 4 is a flowchart showing an operation for associating the characteristic information with the model number information.
After the characteristic information is stored in the characteristic storage unit 7, when the dictionary creation device executes a function of associating the characteristic information with the model number information by a user operation, the display unit 8 stores the characteristic storage table stored in the characteristic storage unit 7. The MAC address recorded in the record to be stored is read, and the processes of steps S13 and S14 are performed for each MAC address (step S12). The display unit 8 reads characteristic information (combination of characteristic name and characteristic value) from a record associated with a certain MAC address from the characteristic accumulation table stored in the characteristic storage unit 7 (step S13). Next, the display unit 8 displays the set of read characteristic information on the display in association with the MAC address (step S14).

FIG. 5 is a diagram illustrating a display example of a list screen of a set of characteristic information.
When the processes in steps S12 to S14 are executed for all MAC addresses, the display unit 8 displays a set of characteristic information on the display in association with each MAC address as shown in FIG. At this time, the display unit 8 displays a selection button for selecting whether to input the model number of the communication device for each MAC address.

Next, the selection part 9 receives selection of characteristic information (step S15). Specifically, the characteristic information is selected by pressing a selection button displayed on the display using a pointer device.
When the selection unit 9 accepts selection of characteristic information, the display unit 8 displays an input screen for model number information of the communication device indicated by the selected characteristic information (step S16).

FIG. 6 is a diagram illustrating a display example of an input screen for model number information.
In step S16, the display unit 8 displays an input screen as shown in FIG. That is, the display unit 8 displays the MAC address and characteristic information of the selected communication device, and the communication device category, manufacturer name, device name, model number, and comment input form (model number information input form). Is displayed. Further, the display unit 8 displays a registration button for confirming information input in the input form. At this time, it is preferable to specify the manufacturer name from the upper 3 bytes of the MAC address and input it in the input form in advance.
Next, the input unit 10 receives input of model number information (step S17). Specifically, by inputting the model number information in the input form displayed on the display and pressing the registration button, the input of the model number information is confirmed, and the input unit 10 accepts the input of the model number information.

  When the input unit 10 accepts input of model number information, the recording unit 13 records the model number information accepted by the input unit 10 in the model number table of the dictionary storage unit 14 (step S18). More specifically, the dictionary creation device ID of the own device is stored in the dictionary creation device ID of the model number table. A unique learning ID that is not yet stored in the model number table is stored in the learning ID. The category, manufacturer name, device name, model number, and comment received by the input unit 10 are stored in the category, manufacturer name, device name, model number, and comment, respectively. The current time is stored in the learning date.

  Next, the recording unit 13 generates a property name list that is a list of property names that are collected by the program stored in the program storage unit 1 from the program information storage unit 12 (step S19). The property name list is generated by executing the following processing.

FIG. 7 is a flowchart of the characteristic name list generation process.
First, the recording unit 13 reads the program ID and start time of the currently used program (end time is NULL) from the program registration table stored in the program information storage unit 12 (step S101), and the program ID and start The characteristic name associated with the time is read from the parameter table stored in the program information storage unit 12 (step S102). Next, the recording unit 13 adds the characteristic name read in step S102 to the characteristic name list (step S103).

Further, the recording unit 13 reads the oldest recording date and time among the recording dates and times of the characteristic information selected in step S15 (step S104). Next, the recording unit 13 reads out a program ID and a start time indicating a time after the recording date and time with the oldest end time from the program registration table stored in the program information storage unit 12 (step S105), and the program ID and The characteristic name associated with the start time is read from the parameter table stored in the program information storage unit 12 (step S106). Next, the recording unit 13 adds the characteristic name read in step S106 to the characteristic name list (step S107).
Through the above processing, the recording unit 13 generates a list of characteristic names.

  When the property name list is generated in step S19, the recording unit 13 records the property name indicated by the property name list in the learning parameter table stored in the dictionary storage unit 14 (step S20). Specifically, a predetermined dictionary creation device ID is stored in the dictionary creation device ID of the learning parameter table. The learning ID stored in the model number table in step S18 is stored in the learning ID. In the property name, the property name indicated by the property name list generated in step S19 is stored.

  Next, the recording unit 13 reads out the characteristic names from the characteristic name list generated in step S19, and executes the processes of steps S22 to S24 for each characteristic name (step S21). First, the recording unit 13 determines whether or not characteristic information corresponding to a certain characteristic name indicated in the characteristic name list is in the set of characteristic information selected in step S15 (step S22). When the characteristic name is in the set of characteristic information selected in step S15 (step S22: YES), the characteristic information is read from the characteristic accumulation table of the characteristic storage unit 7, and the characteristic value indicated by the characteristic information is It records in the detailed table which the dictionary memory | storage part 14 memorize | stores (step S23). Specifically, a predetermined dictionary creation device ID is stored in the dictionary creation device ID of the detailed table. The learning ID stored in the model number table in step S18 is stored in the learning ID. The characteristic name read in step S21 is stored in the characteristic name. The characteristic value of the selected characteristic information is stored in the characteristic value. After recording the characteristic information in the detailed table in step S23, the recording unit 13 deletes the characteristic information from the characteristic accumulation table stored in the characteristic storage unit 7 to confirm that the registration in the detailed table is completed. It is desirable to prevent the property information from being double-registered by giving the information shown.

  On the other hand, if the characteristic name read in step S21 is not in the set of characteristic information selected in step S15 (step S22: NO), the dictionary storage unit 14 stores the characteristic value as a value indicating “no information”. To be recorded in the detailed table (step S24). Specifically, a predetermined dictionary creation device ID is stored in the dictionary creation device ID of the detailed table. The learning ID stored in the model number table in step S18 is stored in the learning ID. The characteristic name read in step S21 is stored in the characteristic name. A characteristic value indicating “no information” is stored in the characteristic value.

  Through the above processing, the dictionary storage unit 14 accumulates dictionary information that associates the characteristic information indicating the characteristics of the packet of the communication device with the model number information of the communication device. In particular, dictionary information can be created for newly released devices and devices that are less frequently used, so that the coverage rate of compatible devices can be increased.

  In the present embodiment, the dictionary storage unit 14 of the dictionary creation device stores a model number table, a detail table, and a learning parameter table separately. Thereby, even when a program is newly added to or deleted from the program storage unit 1, accumulation of dictionary information can be continued without changing the database scheme.

  Further, in the present embodiment, the response analysis unit and the capture analysis unit of the dictionary creation device extract characteristic information using packet header information. Therefore, dictionary information can be created without infringing on user privacy.

<Device identification stage>
Next, an identification apparatus according to an embodiment of the present invention will be described.
FIG. 8 is a schematic block diagram showing the configuration of the identification device according to one embodiment of the present invention.
The identification device includes a program storage unit 1, a request transmission unit 2, a response reception unit 3, a response analysis unit 4, a packet capture unit 5, a capture analysis unit 6, a characteristic storage unit 7, a display unit 8, a selection unit 9, and a program management unit. 11, a program information storage unit 12, a dictionary storage unit 14, and an identification unit 15 (comparison unit).

The identification unit 15 compares the dictionary information stored in the dictionary storage unit 14 with the characteristic information extracted by the response analysis unit 4 and the capture analysis unit 6, and identifies the model number of the communication device.
The program storage unit 1, the request transmission unit 2, the response reception unit 3, the response analysis unit 4, the packet capture unit 5, the capture analysis unit 6, the characteristic storage unit 7, the display unit 8, the selection unit 9, the program management unit 11, Since the program information storage unit 12 and the dictionary storage unit 14 have the same operations and configurations as the respective processing units of the dictionary creation device, they will be described using the same reference numerals.
The dictionary storage unit 14 stores in advance dictionary information created by the dictionary creation device.

Next, the operation of the identification device will be described.
The process of adding / deleting a program to / from the identification device and the operation of extracting the characteristic information by analyzing the packet of the communication device are the same as the operation of the dictionary creation device described above. Therefore, description of processing for adding / deleting a program to / from the identification apparatus and operation for extracting characteristic information by analyzing a packet of the communication apparatus will be omitted.

Next, an operation in which the identification device identifies the communication device will be described.
FIG. 9 is a flowchart illustrating an operation in which the identification device identifies a communication device.
After the characteristic information of the newly connected communication device is accumulated in the characteristic storage unit 7, when the identification device executes a function of identifying the communication device by a user operation, the identification unit 15 reads from the program information storage unit 12. A property name list that is a list of property names that are collected by the program stored in the program storage unit 1 is generated (step S31). The characteristic name list is generated by executing the process of FIG. 7, as in the dictionary creation apparatus.

Next, the identification unit 15 reads out each characteristic name from the characteristic name list generated in step S31, and executes the processing of step S33 to step S34 for each characteristic name (step S32). First, the identification unit 15 determines whether or not characteristic information corresponding to a certain characteristic name indicated in the characteristic name list is in the set of characteristic information stored in the characteristic storage unit 7 (step S33). If the characteristic name is not in the set of characteristic information stored in the characteristic storage unit 7 (step S33: NO), the characteristic information indicating that the characteristic value is “no information” is created for the characteristic name, It records in the characteristic memory | storage part 7 (step S34).
On the other hand, when the characteristic name read in step S32 is in the set of characteristic information stored in the characteristic storage unit 7 (step S33: YES), the process is performed without performing the process, and the next characteristic name determination process is performed. Move.

  Next, the identification unit 15 reads the learning ID from each record of the model number table in the dictionary storage unit 14, and executes the processing of step S36 to step S39 for each learning ID (step S35). First, the identification unit 15 reads a learning parameter table record associated with the read learning ID from the dictionary storage unit 14. Next, the characteristic name indicated by the record is compared with the record in the characteristic storage table of the characteristic storage unit 7, and the characteristic name to be compared is determined (step S36). Specifically, the characteristic names stored in both the characteristic accumulation table and the learning parameter table are determined as comparison targets.

Next, for each characteristic name determined as a comparison target in step S36 (step S37), the identification unit 15 stores the characteristic value stored in the characteristic accumulation table associated with the characteristic name and details of the dictionary storage unit 14 A distance between the characteristic values stored in the table is calculated (step S38). In the present embodiment, “distance” indicates the magnitude of the difference between the characteristic values.
For the calculation of the distance, basically, a calculation method is used in which the distance is “0” if the characteristic values are the same, and the distance is “1” if the characteristic values are different from each other. A distance calculation method may be used. At this time, the distance is similarly calculated for the characteristic information whose characteristic value indicates “no information”. That is, when one indicates “no information” and the other has some information, the distance is “1”, and when both indicate “no information”, the distance is “0”.
The fact that the characteristic value of certain characteristic information indicates “no information” means that the packet having the characteristic information was not transmitted from the communication apparatus even though the dictionary creation device had a program for the characteristic information. Indicates. The fact that a packet of a certain protocol has not been transmitted indicates that the communication apparatus has a characteristic indicating that it does not support the protocol. Therefore, in this embodiment, information having a characteristic value indicating “no information” is also used for calculating the distance.

For example, when the characteristic value indicates version information, the absolute value of the difference between the characteristic values is preferably the distance. Further, when the characteristic value indicates the title name of the web page (a character string in the <title> tag of the HTML document obtained when accessed by HTTP), it is preferable to calculate the edit distance of each characteristic value. The edit distance is the number of character insertions, deletions, and replacements performed when transforming a character string into another character string.
Note that the distance calculated by using these calculation methods is different in weight from the distance calculated by the basic distance calculation method. For this reason, it is more preferable to appropriately weight according to the calculation method.
The calculated distance is preferably weighted according to the importance of the characteristic information. By performing weighting according to the importance of the characteristic information, the accuracy of device identification can be improved.

After calculating the distances for all the characteristic names determined in step S36, the identification unit 15 calculates the average value of the calculated distances, and the learning ID read out in step S35 is the reciprocal number (similarity) of the average value. (S39).
When scores are calculated for all learning IDs read from each record in the model number table of the dictionary storage unit 14, the model number information with the highest score is identified as a communication device newly connected to the network (step S40). ). Thereby, the identification apparatus can identify the communication apparatus newly connected to the network.

  As described above, according to the present embodiment, the program management unit 11 adds / deletes a program for analyzing a packet of a predetermined protocol to the program storage unit 1. Thereby, the data amount memorize | stored in the program memory | storage part 1 can be made appropriate, and an identification process can be performed using a suitable protocol.

  Moreover, according to this embodiment, the identification part 15 is the characteristic information which was not extracted by the response analysis part 4 and the capture analysis part 6 among the characteristic information which can be extracted using the program which the program memory | storage part 1 memorize | stores, Comparison processing is performed as characteristic information indicating “no information”. Thereby, since the comparison process can be performed using a characteristic indicating that the communication device does not support the predetermined protocol, the identification accuracy can be increased.

  Moreover, according to this embodiment, the identification part 15 is distance with respect to the characteristic information which the program which a program memory | storage part can extract among the characteristic information which a dictionary memory | storage part 14 memorize | stores in association with the same model number information. Is calculated. That is, the characteristic value associated with the characteristic name stored in both the characteristic accumulation table and the learning parameter table is used as a distance calculation target. As a result, the characteristic information of the characteristic name stored only in the characteristic accumulation table and the characteristic information of the characteristic name stored only in the learning parameter table are not subject to distance calculation. Therefore, even when the characteristic name of the characteristic information stored in the dictionary storage unit and the characteristic name of the characteristic information that can be extracted by the response analysis unit 4 and the capture analysis unit 6 do not completely match, the communication device can be identified. .

As described above, the embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to the above, and various design changes and the like can be made without departing from the scope of the present invention. It is possible to
For example, in the present embodiment, the case where the dictionary creation device and the identification device operate as separate devices has been described. However, the present invention is not limited to this, and a device having the functions of the dictionary creation device and the identification device may be used. good.

  In addition, although this embodiment demonstrated the case where a dictionary creation apparatus and an identification apparatus operate | move stand-alone, it is not restricted to this. For example, the dictionary creation device and the identification device may be connected to the dictionary information management server via the Internet, and may be designed as an identification system including the dictionary creation device, the identification device, and the dictionary information management server. In this case, the dictionary creation device registers the dictionary information by transmitting the dictionary information to the dictionary information management server, and the identification device performs the identification process by receiving the dictionary information from the dictionary information management server. The dictionary information created by the dictionary information creation device according to the present embodiment is dictionary information created only from a communication device connected to a certain home network. On the other hand, the dictionary information created using the above identification system becomes dictionary information collected from a plurality of home network communication devices, so that the identification device can identify with higher accuracy.

In the present embodiment, the case where the program information storage unit 12 stores the program registration table and the parameter table and generates the characteristic name list using these pieces of information has been described. However, the present invention is not limited to this. For example, when the program management unit 11 performs addition / deletion processing of a program, a characteristic name list indicating characteristic names extracted by the program is stored in the program information storage unit 12 instead of registration in the program registration table and the parameter table. By recording, the above process may be executed using the characteristic name list stored in the program information storage unit 12 without executing the procedure shown in FIG.
Further, when the program stored in the program storage unit 1 includes a function that returns a characteristic name extracted by itself, the function name list can be obtained without using the program information storage unit 12 by causing the program to execute the function. Can be generated.

  In the present embodiment, the dictionary storage unit 14 may store the same communication device information for different learning IDs. In this case, if the identification device simply displays the model number information of the communication device in the order of the highest score calculated for each learning ID in step S40, only the same model number information is displayed on the display unit 8. In order to prevent this, the identification unit 15 of the identification device compares the average values of the scores of the learning IDs having the same model number information in step S40 and displays the model number information in descending order of the average score. good.

  As another method, the identification unit 15 of the identification device calculates the average and standard deviation of the characteristic values associated with the learning ID having the same model number information in advance in step S36, and obtains information deviating from 3σ from the average. Ignore and calculate the average of the characteristic values again. Then, the average value obtained for the second time may be compared with the characteristic value of the communication device newly connected to the network, and the one with the highest score may be adopted. Further, the calculation of the standard deviation and the process of ignoring the information deviating from the average may be repeated until convergence.

  As another method, the identification unit 15 of the identification device compares only the highest score among the scores of learning IDs having the same model number information in step S40 and displays the model number information in descending order of the score. Also good.

  In the present embodiment, the case where the execution of device identification is executed with the selection button displayed on the display as an opportunity has been described. However, the present invention is not limited to this. For example, the device identification is performed after a certain period of time or a certain number of characteristics are extracted. Device identification may be executed for communication devices that are not used.

  Further, in the present embodiment, the case has been described in which the model number information with the highest score is identified as a communication device newly connected to the network in step S40, but the present invention is not limited to this, and the score is high in step S40. The identification processing may be performed by displaying a plurality of model number information and selecting one of them. Specifically, the processing can be executed as follows.

FIG. 10 is a diagram illustrating a display example of an identification result screen according to another embodiment.
As shown in FIG. 10, the display unit 8 displays the model number information of the communication device in descending order of the score calculated for each learning ID. That is, the display unit 8 displays the MAC address and IP address of the communication apparatus newly selected for the network, and displays a plurality of (four in the example of FIG. 10) model number information with high scores side by side along with the scores. . Further, the display unit 8 displays a determination button for selecting the same model number information as that of the communication apparatus from among these model number information.
Next, the selection unit 9 accepts selection of one piece of model number information from the model number information displayed on the display. Specifically, selection of the model number information is accepted by pressing any one of the determination buttons displayed on the display. Thereby, the identification apparatus can identify the communication apparatus newly connected to the network.

  The dictionary creation device and identification device described above have a computer system inside. The operation of each processing unit described above is stored in a computer-readable recording medium in the form of a program, and the above processing is performed by the computer reading and executing this program. Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The implementation of the dictionary creation device and the identification device according to the present embodiment can be implemented by the OSGi framework, but is not limited to this, and can be implemented by using other frameworks.

  DESCRIPTION OF SYMBOLS 1 ... Program memory | storage part 2 ... Request transmission part 3 ... Response reception part 4 ... Response analysis part 5 ... Packet capture part 6 ... Capture analysis part 7 ... Characteristic storage part 8 ... Display part 9 ... Selection part 10 ... Input part 11 ... Program Management unit 12 ... Program information storage unit 13 ... Recording unit 14 ... Dictionary storage unit 15 ... Identification unit

Claims (7)

An identification device for identifying a communication device connected to a network,
A receiving unit for receiving a packet from the communication device;
A program storage unit for storing one or more programs for analyzing predetermined packets received by the receiving unit and extracting predetermined characteristic information;
A program management unit that accepts an instruction to add or delete the program, adds a program to the program storage unit, or deletes a program from the program storage unit;
An analysis unit that analyzes a packet received by the reception unit by executing a program stored in the program storage unit and extracts characteristic information indicating characteristics of the communication device;
A comparison unit that calculates the similarity between the characteristic information stored in the dictionary storage unit that stores the characteristic information of the communication device and the model information of the communication device in association with each other, and the characteristic information extracted by the analysis unit;
An identification unit for identifying that one piece of model number information is model number information of a communication apparatus connected to a network from among model number information associated with characteristic information having a high degree of similarity calculated by the comparison unit. An identification device. The comparison unit performs a comparison process on the characteristic information that is not extracted by the analysis unit among the characteristic information that can be extracted by using the program stored in the program storage unit, as characteristic information indicating that there is no information. The identification apparatus according to claim 1, wherein The comparison unit calculates the similarity with respect to characteristic information that can be extracted by a program stored in the program storage unit among characteristic information stored in association with the same model number information in the dictionary storage unit. The identification device according to claim 1, wherein the identification device is characterized. The dictionary storage unit
A model number table for storing model number information of the communication device and identification information unique to the communication device;
Storing the detailed table storing the identification information and the device information in association with each other;
The recording unit records the characteristic information collected by the collecting unit in the model number table in association with the identification information of the communication device, and associates the model number information input by the input unit with the identification information of the communication device in the details. It records on a table. The identification apparatus of any one of Claims 1-3 characterized by the above-mentioned. Among the similarities calculated by the comparison unit, a display unit that displays a predetermined number of model number information associated with the highest similarity,
A selection unit that receives selection of model number information displayed by the display unit, and
The said identification part identifies that the model number information selected by the said selection part is model number information of the communication apparatus connected to the network. Any one of Claims 1-4 characterized by the above-mentioned. Identification device. An identification method using an identification device for identifying a communication device connected to a network,
The receiving unit receives a packet from the communication device,
The program management unit accepts an instruction to add or delete a program for extracting predetermined characteristic information by analyzing a packet of a predetermined protocol received by the receiving unit, and adds the program to the program storage unit or stores the program Delete the program from the
The analysis unit extracts the characteristic information indicating the characteristics of the communication device by analyzing the packet received by the reception unit by executing the program stored in the program storage unit,
The comparison unit calculates the similarity between the characteristic information stored in the dictionary storage unit that stores the characteristic information of the communication device and the model information of the communication device in association with each other, and the characteristic information extracted by the analysis unit,
The identifying unit identifies that one model number information among the model number information associated with the characteristic information having a high similarity calculated by the comparison unit is the model number information of the communication device connected to the network. Identification method to do. An identification device for identifying a communication device connected to a network, comprising a program storage unit for storing one or more programs for analyzing a packet of a predetermined protocol and extracting predetermined characteristic information,
A receiving unit for receiving a packet from the communication device;
A program management unit that receives an instruction to add or delete the program and adds a program to the program storage unit or deletes a program from the program storage unit;
An analysis unit that analyzes a packet received by the reception unit by executing a program stored in the program storage unit and extracts characteristic information indicating characteristics of the communication device;
A comparison unit that calculates the similarity between the characteristic information stored in the dictionary storage unit that stores the characteristic information of the communication device and the model information of the communication device in association with each other, and the characteristic information extracted by the analysis unit;
A program for functioning as an identification unit for identifying that one piece of model number information is model number information of a communication device connected to a network from among model number information associated with characteristic information having a high degree of similarity calculated by the comparison unit .

Images